Skip to content

Commit 5cf077b

Browse files
andrewkrohandrewkroh
committed
fix(system,windows): normalize SidList in event 4908
Adds whitespace normalization for the SidList field in Windows Security event 4908 (Special Groups Logon table modified). The ingest pipeline now uses a gsub processor to normalize separators before parsing, and the Painless script handles the normalized format correctly. Test data originates from elastic/beats@dd7a1b3
1 parent 2e6cacd commit 5cf077b

File tree

10 files changed

+246
-5
lines changed

10 files changed

+246
-5
lines changed

‎packages/system/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "2.7.1"
3+
changes:
4+
- description: Fixed parsing of SidList field in Windows Security event 4908 (Special Groups Logon table modified) by normalizing whitespace separators.
5+
type: bugfix
6+
link: https://github.com/elastic/integrations/pull/15797
27
- version: "2.7.0"
38
changes:
49
- description: Add NTP data stream.

‎packages/system/data_stream/security/_dev/test/pipeline/test-security-windows2016-4908.json‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
{
2+
"events": [
3+
{
4+
"@timestamp": "2020-08-19T06:07:25.0461779Z",
5+
"event": {
6+
"action": "Audit Policy Change",
7+
"code": "4908",
8+
"kind": "event",
9+
"outcome": "success",
10+
"provider": "Microsoft-Windows-Security-Auditing"
11+
},
12+
"host": {
13+
"name": "WIN-BVM4LI1L1Q6.TEST.local"
14+
},
15+
"log": {
16+
"level": "information"
17+
},
18+
"labels": {
19+
"origin": "https://github.com/elastic/beats/commit/dd7a1b3808eb98e77fb49b268cd3764cc17eff5b"
20+
},
21+
"message": "Special Groups Logon table modified.\n\nSpecial Groups:\t\n\t\t%{S-1-5-32-544}\n\t\t%{S-1-5-32-123-54-65}\n\nThis event is generated when the list of special groups is updated in the registry or through security policy. The updated list of special groups is indicated in the event.",
22+
"winlog": {
23+
"channel": "Security",
24+
"computer_name": "WIN-BVM4LI1L1Q6.TEST.local",
25+
"event_data": {
26+
"SidList": "\n\t\t%{S-1-5-32-544}\n\t\t%{S-1-5-32-123-54-65}"
27+
},
28+
"event_id": "4908",
29+
"keywords": [
30+
"Audit Success"
31+
],
32+
"opcode": "Info",
33+
"process": {
34+
"pid": 784,
35+
"thread": {
36+
"id": 808
37+
}
38+
},
39+
"provider_guid": "{54849625-5478-4994-A5BA-3E3B0328C30D}",
40+
"provider_name": "Microsoft-Windows-Security-Auditing",
41+
"record_id": 140274,
42+
"task": "Audit Policy Change"
43+
}
44+
}
45+
]
46+
}

‎packages/system/data_stream/security/_dev/test/pipeline/test-security-windows2016-4908.json-expected.json‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
{
2+
"expected": [
3+
{
4+
"@timestamp": "2020-08-19T06:07:25.0461779Z",
5+
"ecs": {
6+
"version": "8.11.0"
7+
},
8+
"event": {
9+
"action": "special-group-table-changed",
10+
"category": [
11+
"iam",
12+
"configuration"
13+
],
14+
"code": "4908",
15+
"kind": "event",
16+
"outcome": "success",
17+
"provider": "Microsoft-Windows-Security-Auditing",
18+
"type": [
19+
"admin",
20+
"change"
21+
]
22+
},
23+
"host": {
24+
"name": "WIN-BVM4LI1L1Q6.TEST.local"
25+
},
26+
"labels": {
27+
"origin": "https://github.com/elastic/beats/commit/dd7a1b3808eb98e77fb49b268cd3764cc17eff5b"
28+
},
29+
"log": {
30+
"level": "information"
31+
},
32+
"message": "Special Groups Logon table modified.\n\nSpecial Groups:\t\n\t\t%{S-1-5-32-544}\n\t\t%{S-1-5-32-123-54-65}\n\nThis event is generated when the list of special groups is updated in the registry or through security policy. The updated list of special groups is indicated in the event.",
33+
"winlog": {
34+
"channel": "Security",
35+
"computer_name": "WIN-BVM4LI1L1Q6.TEST.local",
36+
"event_data": {
37+
"SidList": [
38+
"%{S-1-5-32-544}",
39+
"%{S-1-5-32-123-54-65}"
40+
],
41+
"SidListDesc": [
42+
"Administrators",
43+
"S-1-5-32-123-54-65"
44+
]
45+
},
46+
"event_id": "4908",
47+
"keywords": [
48+
"Audit Success"
49+
],
50+
"opcode": "Info",
51+
"process": {
52+
"pid": 784,
53+
"thread": {
54+
"id": 808
55+
}
56+
},
57+
"provider_guid": "{54849625-5478-4994-A5BA-3E3B0328C30D}",
58+
"provider_name": "Microsoft-Windows-Security-Auditing",
59+
"record_id": "140274",
60+
"task": "Audit Policy Change"
61+
}
62+
}
63+
]
64+
}

‎packages/system/data_stream/security/elasticsearch/ingest_pipeline/standard.yml‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4432,7 +4432,12 @@ processors:
44324432
ctx.winlog?.event_data?.OldTargetUserName != null &&
44334433
ctx.winlog.event_data.OldTargetUserName != "-"
44344434
4435-
4435+
- gsub:
4436+
description: Normalize separators in the SidList value.
4437+
field: winlog.event_data.SidList
4438+
pattern: '\s+'
4439+
replacement: ' '
4440+
ignore_missing: true
44364441
- script:
44374442
lang: painless
44384443
ignore_failure: false

‎packages/system/manifest.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
format_version: 3.0.2
22
name: system
33
title: System
4-
version: "2.7.0"
4+
version: "2.7.1"
55
description: Collect system logs and metrics from your servers with Elastic Agent.
66
type: integration
77
categories:

‎packages/windows/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "3.1.3"
3+
changes:
4+
- description: Fixed parsing of SidList field in Windows Security event 4908 (Special Groups Logon table modified) by normalizing whitespace separators.
5+
type: bugfix
6+
link: https://github.com/elastic/integrations/pull/15797
27
- version: "3.1.2"
38
changes:
49
- description: Remove unused agent files.

‎packages/windows/data_stream/forwarded/_dev/test/pipeline/test-security-windows2016-4908.json‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
{
2+
"events": [
3+
{
4+
"@timestamp": "2020-08-19T06:07:25.0461779Z",
5+
"event": {
6+
"action": "Audit Policy Change",
7+
"code": "4908",
8+
"kind": "event",
9+
"outcome": "success",
10+
"provider": "Microsoft-Windows-Security-Auditing"
11+
},
12+
"host": {
13+
"name": "WIN-BVM4LI1L1Q6.TEST.local"
14+
},
15+
"log": {
16+
"level": "information"
17+
},
18+
"labels": {
19+
"origin": "https://github.com/elastic/beats/commit/dd7a1b3808eb98e77fb49b268cd3764cc17eff5b"
20+
},
21+
"message": "Special Groups Logon table modified.\n\nSpecial Groups:\t\n\t\t%{S-1-5-32-544}\n\t\t%{S-1-5-32-123-54-65}\n\nThis event is generated when the list of special groups is updated in the registry or through security policy. The updated list of special groups is indicated in the event.",
22+
"winlog": {
23+
"channel": "Security",
24+
"computer_name": "WIN-BVM4LI1L1Q6.TEST.local",
25+
"event_data": {
26+
"SidList": "\n\t\t%{S-1-5-32-544}\n\t\t%{S-1-5-32-123-54-65}"
27+
},
28+
"event_id": "4908",
29+
"keywords": [
30+
"Audit Success"
31+
],
32+
"opcode": "Info",
33+
"process": {
34+
"pid": 784,
35+
"thread": {
36+
"id": 808
37+
}
38+
},
39+
"provider_guid": "{54849625-5478-4994-A5BA-3E3B0328C30D}",
40+
"provider_name": "Microsoft-Windows-Security-Auditing",
41+
"record_id": 140274,
42+
"task": "Audit Policy Change"
43+
}
44+
}
45+
]
46+
}

‎packages/windows/data_stream/forwarded/_dev/test/pipeline/test-security-windows2016-4908.json-expected.json‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
{
2+
"expected": [
3+
{
4+
"@timestamp": "2020-08-19T06:07:25.0461779Z",
5+
"ecs": {
6+
"version": "8.11.0"
7+
},
8+
"event": {
9+
"action": "special-group-table-changed",
10+
"category": [
11+
"iam",
12+
"configuration"
13+
],
14+
"code": "4908",
15+
"kind": "event",
16+
"outcome": "success",
17+
"provider": "Microsoft-Windows-Security-Auditing",
18+
"type": [
19+
"admin",
20+
"change"
21+
]
22+
},
23+
"host": {
24+
"name": "WIN-BVM4LI1L1Q6.TEST.local"
25+
},
26+
"labels": {
27+
"origin": "https://github.com/elastic/beats/commit/dd7a1b3808eb98e77fb49b268cd3764cc17eff5b"
28+
},
29+
"log": {
30+
"level": "information"
31+
},
32+
"message": "Special Groups Logon table modified.\n\nSpecial Groups:\t\n\t\t%{S-1-5-32-544}\n\t\t%{S-1-5-32-123-54-65}\n\nThis event is generated when the list of special groups is updated in the registry or through security policy. The updated list of special groups is indicated in the event.",
33+
"winlog": {
34+
"channel": "Security",
35+
"computer_name": "WIN-BVM4LI1L1Q6.TEST.local",
36+
"event_data": {
37+
"SidList": [
38+
"%{S-1-5-32-544}",
39+
"%{S-1-5-32-123-54-65}"
40+
],
41+
"SidListDesc": [
42+
"Administrators",
43+
"S-1-5-32-123-54-65"
44+
]
45+
},
46+
"event_id": "4908",
47+
"keywords": [
48+
"Audit Success"
49+
],
50+
"opcode": "Info",
51+
"process": {
52+
"pid": 784,
53+
"thread": {
54+
"id": 808
55+
}
56+
},
57+
"provider_guid": "{54849625-5478-4994-A5BA-3E3B0328C30D}",
58+
"provider_name": "Microsoft-Windows-Security-Auditing",
59+
"record_id": "140274",
60+
"task": "Audit Policy Change"
61+
}
62+
}
63+
]
64+
}

‎packages/windows/data_stream/forwarded/elasticsearch/ingest_pipeline/security_standard.yml‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3931,7 +3931,12 @@ processors:
39313931
ctx.winlog?.event_data?.OldTargetUserName != null &&
39323932
ctx.winlog.event_data.OldTargetUserName != "-"
39333933
3934-
3934+
- gsub:
3935+
description: Normalize separators in the SidList value.
3936+
field: winlog.event_data.SidList
3937+
pattern: '\s+'
3938+
replacement: ' '
3939+
ignore_missing: true
39353940
- script:
39363941
lang: painless
39373942
ignore_failure: false
@@ -4260,7 +4265,8 @@ processors:
42604265
42614266
void splitSidList(def sids, def params, def ctx) {
42624267
ArrayList al = new ArrayList();
4263-
def sidList = sids.splitOnToken(" ");
4268+
def sidsArray = sids.splitOnToken(" ");
4269+
ArrayList sidList = new ArrayList(Arrays.asList(sidsArray));
42644270
ctx.winlog.event_data.put("SidList", sidList);
42654271
for (def i = 0; i < sidList.length; i++ ) {
42664272
al.add(translateSID(sidList[i].replace("%", "").replace("{", "").replace("}", "").replace(" ",""), params));

‎packages/windows/manifest.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
name: windows
22
title: Windows
3-
version: 3.1.2
3+
version: 3.1.3
44
description: Collect logs and metrics from Windows OS and services with Elastic Agent.
55
type: integration
66
categories:

0 commit comments

Comments
 (0)